[Fedora-directory-users] Re: Fedora-directory-users Digest, Vol 42, Issue 4

[Rich Megginson]

Howard Chu wrote:
>> Date: Tue, 04 Nov 2008 08:13:08 -0700
>> From: Rich Megginson<rmeggins at redhat.com>
>
>> John Dickinson wrote:
>>> On 30 Oct 2008, at 16:00, Rich Megginson<rmeggins at redhat.com>  wrote:
>
>>> create user in AD                    userAccountControl: 512 (Normal)
>>> create user in Fedora DS (console)   userAccountControl: 546 (Normal +
>>> PASSWD_NOTREQ + ACCOUNTDISABLE)
>>>
>>> Would there be anything wrong with Fedora DS just forcing
>>> userAccountControl = 512? Or are more options needed in the user
>>> creation dialog?
>> I'm not sure.  1.1.3 included a "fix" for userAccountControl.  The way
>> it works now is this:
>> add new AD entry over LDAP - no userAccountControl attribute is present,
>> so it must use some sort of AD default value
>> read the new AD entry - get the userAccountControl value
>> set AD entry userAccountControl |= 0x200 # 512 == normal account)
>>
>> So you might try a simple test - add a new AD entry over LDAP outside of
>> windows sync - see what the default userAccountControl value is - I'm
>> guessing that adding a new AD entry without specifying
>> userAccountControl sets it to PASSWD_NOTREQ + ACCOUNTDISABLE
>
> Yes, users created via LDAP are disabled unless you explicitly provide 
> the userAccountControl attribute (with proper flags) in the LDAP Add 
> operation. I tripped over this myself the first time I loaded up a 
> test database in AD. (It also gave me a Fine Opportunity to time how 
> long it took to LDAP Modify all of the users in my test database. ugh...)
>
Then this is a bug in the winsync code.  In the ADD case, it should just 
force userAccountControl to the Normal value.  In the MOD case, it 
should |= the value.  John, can you open a bug about this issue?  Thanks.